← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_0ffb4081.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_0ffb4081.sysSample 1 · HVCI TRUE
- MD5
be0b6b1507605522a02cf6f8ad969e22- SHA1
30979e39351839222606ead9b7ae37e310e5c889- SHA256
0ffb4081fe867c98118e472538e8a3e6feac2a9d80b5ae2d4e2b621b344cd6d9- Imphash
ce10082e1aa4c1c2bd953b4a7208e56a- Authentihash MD5
b822f64e2367cf642865661f68165a16- Authentihash SHA1
f654b43830559fe322f02c43d0f43219fe58d821- Authentihash SHA256
270bbba20190463a27ae41ec283922b25d397aab31c96cd4eaa47eadaac07b00- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10